If you discover a security vulnerability in SpecSync, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: security@corvidlabs.com

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment within 48 hours
• Assessment within 1 week
• Fix or mitigation for confirmed vulnerabilities as soon as possible
• Credit in the release notes (unless you prefer anonymity)

SpecSync is a local CLI tool and GitHub Action. The primary security concerns are:

• Path traversal — spec file paths or cross-project references escaping the intended directory
• Code injection — malicious spec content causing unexpected behavior during parsing
• GitHub Action security — token exposure, unsafe input handling in CI
• Dependency vulnerabilities — issues in upstream Rust crates

• Bugs that require physical access to the machine running SpecSync
• Issues in dependencies that have already been reported upstream
• Denial of service via extremely large files (SpecSync is a local tool)

• Pin SpecSync to the current major version in CI (uses: CorvidLabs/spec-sync@v5), or to a full release tag/commit for stronger reproducibility
• Review spec files from untrusted sources before running validation
• Remote cross-project validation is opt-in; only pass resolve --remote or resolve --verify when network-backed reference checks are required